homepage

174 static
 175 int unicode_resize(register PyUnicodeObject *unicode,
 176 Py_ssize_t length)
 177 {
 [...]
 201 
 202 oldstr = unicode->str;
 203 PyMem_RESIZE(unicode->str, Py_UNICODE, length + 1);
[...]
 209 unicode->str[length] = 0;
 210 unicode->length = length;
 211 
 95 #define PyMem_RESIZE(p, type, n) \
 96 ( assert((n) <= PY_SIZE_MAX / sizeof(type)) , \
 97 ( (p) = (type *) PyMem_REALLOC((p), (n) * sizeof(type)) ) )
The unicode_resize() function acts essentially as a wrapper to
realloc(), it accomplishes this via the PyMem_RESIZE() macro which
factors the size with the size of the type, in this case it multiplies
by two as Py_UNICODE is typedef'd to a wchar_t. When resizing large
strings, this results in an incorrect allocation that in turn leads to
buffer overflow.
This is specific to the Unicode objects, however I would not be
surprised to see that other types have this complication as well. Please
see attached proof of concepts.